IM
IronMonkey Threat Research
‹ Back to ICS Advisories

PowerLogic EGX100 and PowerLogicEGX300

CRITICAL
CVSS 9.8
Date 2026-10-16T20:40:38+00:00
Source schneider-electric
Published by Schneider Electric

// Description

Schneider Electric Security Notification 8-Jun-21 Document Reference Number – SEVD-2021 -159-03 Page 1 of 4 ## PowerLogic EGX100 and PowerLogicEGX300 8 June 2021 Overview Schneider Electric is aware of multiple vulnerabilities in its PowerLogic EGX100 and EGX300 products. The PowerLogic EGX100 and EGX300 are communication gateway devices. Failure to apply the mitigations provided below may risk denial of service or remote code execution, which could result in loss of device functionality. Affected Products and Versions CVE Product Version CVE-2021-22763 EGX100 All Versions CVE-2021-22764, CVE-2021-22765, CVE-2021-22766, CVE-2021-22767, CVE-2021-22768 EGX100 Versions 3.0.0 and newer CVE-2021-22763, CVE-2021-22764, CVE-2021-22765, CVE-2021-22766, CVE-2021-22767, CVE-2021-22768 EGX300 All Versions Vulnerability Details CVE ID: CVE-2021-22763 CVSS v3.1 Base Score 8.1 | High | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H A CWE-640: Weak Password Recovery Mechanism for Forgotten Password vulnerability exists that could allow an attacker administrator level access to a device. CVE ID: CVE-2021-22764 CVSS v3.1 Base Score 5.3 | Medium | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L A CWE-287: Improper Authentication vulnerability exists that could cause loss of connectivity to the device via Modbus TCP protocol when an attacker sends a specially crafted HTTP request. CVE ID: CVE-2021-22765 CVSS v3.1 Base Score 9.8 | Critical | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H A CWE-20: Improper Input Validation vulnerability exists that could cause denial of service or remote code execution via a specially crafted HTTP packet. Schneider Electric Security Notification 8-Jun-21 Document Reference Number – SEVD-2021 -159-03 Page 2 of 4 CVE ID: CVE-2021-22766 CVSS v3.1 Base Score 7.5 | High | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

// Vulnerabilities (6)

CVE ID CVSS Score Severity Description
CVE-2021-22765 9.8 high
A CWE-20: Improper Input Validation vulnerability exists in PowerLogic EGX100 (Versions 3.0.0 and newer) and PowerLogic EGX300 (All Versions) that could cause denial of service or remote code execution via a specially crafted HTTP packet
CVE-2021-22766 9.8 high
A CWE-20: Improper Input Validation vulnerability exists in PowerLogic EGX100 (Versions 3.0.0 and newer) and PowerLogic EGX300 (All Versions) that could cause denial of service via a specially crafted HTTP packet
CVE-2021-22764 9.8 high
A CWE-287: Improper Authentication vulnerability exists in PowerLogic PM55xx, PowerLogic PM8ECC, PowerLogic EGX100 and PowerLogic EGX300 (see security notification for version infromation) that could cause loss of connectivity to the device via Modbus TCP protocol when an attacker sends a specially crafted HTTP request.
CVE-2021-22763 9.8 high
A CWE-640: Weak Password Recovery Mechanism for Forgotten Password vulnerability exists in PowerLogic PM55xx, PowerLogic PM8ECC, PowerLogic EGX100 and PowerLogic EGX300 (see security notification for version infromation) that could allow an attacker administrator level access to a device.
CVE-2021-22768 9.8 high
A CWE-20: Improper Input Validation vulnerability exists in PowerLogic EGX100 (Versions 3.0.0 and newer) and PowerLogic EGX300 (All Versions) that could cause denial of service or remote code execution via a specially crafted HTTP packet.This CVE ID is unique from CVE-2021-22767
CVE-2021-22767 9.8 high
A CWE-20: Improper Input Validation vulnerability exists in PowerLogic EGX100 (Versions 3.0.0 and newer) and PowerLogic EGX300 (All Versions) that could cause denial of service or remote code execution via a specially crafted HTTP packet.This CVE ID is unique from CVE-2021-2276

// Remediations (4)

Patch: Version 2.8.3 of the PowerLogic PM5560, 5563, 5580 firmware includes fixes for these vulnerabilitie
Version 2.8.3 of the PowerLogic PM5560, 5563, 5580 firmware includes fixes for these vulnerabilities. The version update files are available for download here: https://www.se.com/ww/en/product-range/61281-powerlogicpm5000-power-meters/?parent-subcategoryid=4125&filter=business-2-building-automation-and-control - software-and-firmware If customers choose not to apply the remediation provided above, they should immediately apply the following mitigation to reduce the risk of exploit: Customers should consider blocking HTTP access to the device at the firewall level or disable the HTTP web service to reduce the risk of exposure.
Patch: Version 10.7.3 of the PowerLogic PM5561 firmware includes fixes for these vulnerabilities. The vers
Version 10.7.3 of the PowerLogic PM5561 firmware includes fixes for these vulnerabilities. The version update files are available for download here: https://www.se.com/ww/en/product-range/61281-powerlogicpm5000-power-meters/?parent-subcategoryid=4125&filter=business-2-building-automation-andcontrol#software-and-firmware If customers choose not to apply the remediation provided above, they should immediately apply the following mitigation to reduce the risk of exploit: Customers should consider blocking HTTP access to the device at the firewall level or disable the HTTP web service to reduce the risk of exposure.
Patch: PowerLogic PM8ECC has reached end of service and is no longer supported. Customers should immediate
PowerLogic PM8ECC has reached end of service and is no longer supported. Customers should immediately apply the following mitigation to reduce the risk of exploit: Customers should consider blocking HTTP access to the device at the firewall level once commissioning is complete to reduce the risk of exposure. Additionally, Customers should ensure the General security Recommendations listed below are in place.
Patch: Version 4.3.5 of the PowerLogic PM5562 firmware includes fixes for these vulnerabilities. The versi
Version 4.3.5 of the PowerLogic PM5562 firmware includes fixes for these vulnerabilities. The version update files are available for download here: https://www.se.com/ww/en/product-range/61281-powerlogicpm5000/12146169702-basic-multifunction-metering/?selectednode-id=12146169702&N=brand=se%26countrycode=UK%26language-code=en%26node-id=12146169702 - software-and-firmware If customers choose not to apply the remediation provided above, they should immediately apply the following mitigation to reduce the risk of exploit: Customers should consider blocking HTTP access to the device at the firewall level or disable the HTTP web service to reduce the risk of exposure.

// References